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ABSTRACT 


A review of the contract is presented. Analytical work and digital simulations 
defining system requirements are described. A review of possible multiple system 
configuration improvements is also given. The report concludes with a summary 
of program achievements. 
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INTRODUCTION 


This document forms part of the final report on the Space Shuttle Avionics 
Multiple IMU System, NASA/ MS FC Contract NAS8-27624. 

The contract was originally awarded to the Charles Stark Draper Laboratory 
on July 7, 1971. The initial twelve month effort was devoted to the study and definition 
of failure detection and isolation (FDI) requirements for a multiple gimballed system. 
It also addressed prelaunch requirements for calibration, ground alignment and 
gyrocompassing as well as an inertial navigator. Under this task, a preliminary 
test plan was formulated around the demonstration of FDI development using three 
redundant KT-70 IMUsand a single 47 t -CP2 computer. An interim report covering 
this work phase (R-733, Space Shuttle Avionics A Redundant IMU On-Board Checkout 
and Redundancy Management System ) was published in September, 1972, 

This contract was amended in June, 1972, to add several additional tasks. 
Detailed electronic design of all system units was to be accomplished. These interface 
units would be assembled and their designs verified. An integrated, redundnat IMU 
system would be demonstrated and delivered to NASA/MSFC, Software for this 
system was also specified. Deliverable software included ground alignment and 
gyrocompassing, an inertial navigator, and a full range of FDI programs (Tape 1, 
FDINAV), A multi IMU calibration program was also required (Tape 2, IMUCAL), 

This final report is organized into four volumes which will present in detail 
all activity under the extension of the original contract. This extension required 
both hardware interface and software coding design for a laboratory demonstration 
of this redundant IMU system using threeKT-70 IMUs and a single 4tt -CP2 computer. 

The four volumes describe analytical and developmental activities, hardware 
design, software design, and a system test plan. Each volume is described briefly 
below. 

Volume I— Multiple IMU System Development 

A review of the contract is presented. Analytical work and digital simulations 
defining system requirements are fully described. Failure detection and isolation 
algorithms are presented and new technology achievements described. 
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Volume II — Multiple IMU System Hardware Interface Design 

Design of each system component is described. Emphasis is placed on functional 
requirements unique in this system, including data bus communication, data bus 
transmitters and receivers, and ternary-to-binary torquing decision logic. Mechani- 
zation drawings are presented. 

Volume III — Multiple IMU System Software Design and Coding 

Design of system software is explained: both individual routines and their 

interplay are described. Executive routines, ground alignment, gyrocompassing, 
navigation and calibration routines are presented and described using flowcharts. 
Failure detection and isolation algorithms and system reconfiguration procedures 
are also presented and described with flowcharts. 

Volume IV -"-Multiple IMU System Test Plan 

Operating procedures for this redundant system are described. A test plan 
is developed with two objectives. First, performance of the hardware and software 
delivered is demonstrated. Second, applicability of multiple IMU systems to the 
space shuttle mission is shown through detailed experiments with FDI algorithms 
and other multiple IMU software: gyrocompassing, calibration, and navigation, 

Gimbal flip is examined in light of its possible detrimental effects on FDI and 
navigation. 

1.1 Introduction to Volume I 


This volume of the project final report is an outline of system development. 
Software and hardware development are described, with emphasis on new technology 
appearing in this program. Application of the delivered system as a test tool for 
shuttle avionics concepts is also outlined. The report is concluded with a summary 
of program accomplishments. 
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2, SYSTEM DEVELOPMENT 

The Charles Stark Draper Laboratory has recently concluded a three year 
program in which a redundant gimballed inertial system was analyzed, designed 
and built for the NASA /George Marshall Space Flight Center, The history of 
this program is divided into two phases. The first is an analytical effort, to define 
requirements and mechanization methods for a redundant inertial system. The second 
is a design phase, in which the detailed design and construction of hardware and 
software was carried out. 

It will be evident that this effort evolved in parallel with the emerging space 
shuttle vehicle avionics baseline. The effort has constantly had this goal: to develop 
a system which would be used as a test bed for shuttle concepts. In fact, the shuttle 
baseline did evolve to require IMUs and general purpose computers generically 
similar to those used in this system, although those were independent decisions. 
This program has exerted acknowledged influence on the baseline, however, in several 
areas. The optimal skew geometry developed under this contract has been baselined. 
Failure detection and identification studies performed under this contract have had 
effect on the shuttle FDI requirements. 

2.1 History of the Contract 

The work described in this report has been performed under contract 
NAS8-27624 with NASA/MSFC. This contract was let in July, 1971 (phase I), 
comprising two tasks. These are definition of an autonomous redundancy management 
scheme, including failure detection and identification techniques, and definition of 
an experimental program to verify the system described. 

The contract was amended in June, 1972 (phase II), incorporating responsibility 
for design and delivery of a redundant gimballed inertial system employing off the 
shelf IMUs and computer equipment. This system was delivered to NASA/MSFC in 
January, 1974. 

A follow-on to this work, extending the contract to September, 1974, encom- 
passed additional software development. The user was provided with optional single 
or multiple navigators, and with a choice among several data selection algorithms. 
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2,1,1 Phase I Studies 


The contract awarded to the Draper Laboratory of in July, 1971 set 

forth in the statement of work the study objectives summarized in the following 
sentences: 

”To define an onboard checkout, failure detection, isolation 
and redundancy management scheme for a redundant IMU 
system that meets a fall operational /fail operational/ fail safe 
( FO / FO / FS) criterion. In addition, an experimental program 
that will implement the onboard checkout, failure detection, 
isolation and redundancy management scheme will be de- 
fined.” 

The approach taken to study the failure detection and isolation (FDl) accuracy 
requirements was to use actual shuttle mission trajectory simulations with defined 
terminal accuracy requirements. Acceptable threshold requirements for evaluation 
of FDI implementations were then defined by showing the accuracy requirements of 
individual system coefficients in each trajectory phase and observing error propaga- 
tion characteristics in position and velocity. By use of actual trajectory phases 
and required IMU characteristics to meet terminal accuracy requirements, threshold 
requirements for the multiple system FDI were obtained. This formed the basis of 
all FDI sensitivity-to-requirements evaluations, 

FDI algorithms were subjected to continual simulation and review, and were 
changed significantly over the course of the contract. Details of this history and 
reasons for selection of the algorithms coded are given in Chapter 3, SOFTWARE 
DEVELOPMENT, 

It was the intent in this work to establish a method of FDI which is compatible 
with the off-the-shelf IMU, which could be demonstrated in the laboratory and which 
satisfied baseline accuracy requirements derived for the shuttle mission. 

A second area of interest involved redundant IMU system prelaunch checkout 
procedures. Investigations were made in this study to show how best to use the 
multiple system information as an indication of individual IMU parameter verification 
within expected levels of performance. Initially, interplatform alignment was verified 
using measured gimbal angles. With alignment acceptable, powered flight FDI was 
employed as an aid in judging an individual IMU’s performance. 
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The second task involved defining a test program for a strawman redundant 
system, which was directed to utilize equipment available at NASA/MSFC. The 
test plan for a multiple IMU system at NASA/MSFC was defined directly for three 
production Kearfott KT-70 IMUs and their supporting electronics, mated to an IBM 
4 tt-CP 2 computer. The computerized test facility available at NASA/MSFC, known 
as SSCMS (Strapdown System Control and Monitor Station), would be used in 
monitoring system performance. The test plan presented included single IMU 
calibration and gimbal flip evaluations, multiple IMU gyrocompassing, land naviga- 
tion and powered as well as unpowered flight FDI demonstrations. This plan was 

presented in an interim report. Space Shuttle Avionics A Redundant IMU Qn-board 

Checkout and Redundancy Management System , CSDL report R-733, September, 1972, 

2.1,2 Phase II Efforts 


The contract amendment authorized CSDL to design and build the system 
proposed as a strawman in earlier work. The bulk of this report is concerned with 
documenting that work. 

Volume II, Multiple IMU System Hardware Interface Design, describes the 
delivered hardware. Significant features are explained in Chapter 3 of this volume. 
Volume III, Multiple IMU System Software Design and Coding, describes the software 
delivered with the system. Highlights are described in Chapter 4 of this volume. 
Volume IV, Multiple IMU System Test Plan, is concerned with presenting test 
procedures and evaluation techniques for the system. 

2.1.3 Follow-on Efforts 


The follow-on task under this contract involved developing three data selection 
algorithms and coding them for use as either pre- navigation or post -navigation filters. 
These were simple vector averaging, mid-vector selection and the so-called Kaufman 
Filter, (Vector formulation of the Kaufman Filter was first derived for this work.) 

The user is given a choice among these filters to provide AV for the system 
navigator. (In the initial release, only averaging was available.) Alternatively, the 
user can elect multiple navigators, each driven by a separate IMU, with post selection 
among state vector s using the same data selection algorithms. This work is described 
in section 4.4. 
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2.2 Overview of the Developed System 

CSDL has delivered a system employing three KT-70 IMUs controlled by and 
providing data to a. single 4 ti“CP 2 computer. A bidirectional 10 MHz serial data 
line is employed for all information transfers (commands and data demands). A 
separate line is used for the gyro pulse torquing clock common to all IMUs. 

This system has been designed to interface with NASA/MSFC'e Strapdown 
System Control and Monitor Station, using both analog and digital links. The SSCMS 
is used both for data storage and retrieval purposes and for monitoring the system 
in real time. 

System software, at delivery time, included ground alignment and gyrocom- 
pa ssing, an inertial land navigator, failure detection and identification and redundancy 
management (failure isolation by reconfiguration). A multiple IMU calibration 
program was prepared by fitting Sperry Space Support Division's single KT-70 
calibration program into this system's executive structure. 

Since delivery, navigation capabilities have been extended to comprise either 
a choice among three pre-navigation selection filters or three independent navigators. 
The multiple selection filter /navigator software (Release 2 of FDINAV) is imple- 
mented to respond to FDI decisions so that reconfiguration is identical with that in 
Release 1. 

A detailed test plan has been prepared by CSDL, designed to show the 
applicability of the redundant IMU system to the shuttle problem. This plan includes 
evaluation of multiple IMU gyrocompassing and navigation. Its primary thrust, 
however, involves study of FDI algorithms. It is intended, moreover, that the system 
function as a test bed for shuttle software concepts, as discussed below, 

2.3 Application of This Work to SSV 

It has been mentioned that work done under this contract has contributed 
materially to the emerging shuttle hardware and software baselines. Several examples 
are cited here. 

1. The optimal skew geometry for triply redundant IMUs was derived for 
this system. System FO/FS criteria could be met only with skewed 
platforms permitting autonomous instrument FDI at the two IMU level. 
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CSDL*s derivation of skew orientations with 



simultaneously yielded optimal skew geometry for FDI purposes and 
minimal coding in that transformations were alike. This geometry has 
since been specified for the three shuttle IMUs. 

2, FDI studies performed under this contract have consistently contributed 
to the field as it emerged to meet shuttle requirements. It must be 
borne in mind that this project started quite early in the development 
of redundant IMU systems. FDI analysis performed for it, providing 
self-contained failure identification and fault-down logic, was a pio- 
neering effort. 

3. A more specific example is the use of statistical rather than deterministic 
FDI algorithms. Statistical FDI was developed initially at CSDL for 
use in redundant strapdown systems. Its use in a redundant gimballed 
system was first proposed in this work. While it was not used in the 
delivered software, development continued and it is now proposed as 
the IMU FDI method for operational shuttle vehicles. 

This hardware does not meet shuttle baselines in several regards. However, 
it is sufficiently like the shuttle inertial hardware to permit use as a test bed until 
shuttle hardware is operational. It is likely that no better approximation to the 
redundant flight hardware will be available in 1975. Suggestions for use of this 
system as a test tool appear as Chapter 5. 

2.4 Publications Under This Contract 


CSDL activity under this contract has been documented both in CSDL formal 
publications and in the open literature. There follows a list of publications specifically 
derived from this project. Technology, particularly in FDI and redundancy manage- 
ment, has been transferred to other shuttle related activities at CSDL, and has 
appeared in publications funded by those contracts. 

CSDL reports are: 

1. Richard McKern et.al.. Space Shuttle Avionics— A Redundant IMU 
On-board Checkout and Redundancy Management System, CSDL R-733, 
September, 1972. 
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2. Martin Landey and Richard McKern, Multiple IMU System Development, 
CSDL R-798 Volume I, December, 1974. 

3. Martin Landey and David Brown, Multiple IMU System Hardware Inter- 
face Design. CSDL R-798 Volume II, December, 1974. 

4. Kenneth Vincent, Jr. and Roy Whittredge, Multiple IMU System Software 
Design and Coding, CSDL R-798 Volume III, April, 1974. 

5. Landey, Vincent and Whittredge, Multiple IMU System Test Plan, CSDL 
R-798 Volume IV, October, 1974. 

In the open literature: 

1. David Dove and Richard McKern, Redundancy Management of Multiple 
Inertial Systems For Space Shuttle, ION Conference, Orlando, March, 
1972. (Also published as CSDL E-2652, April, 1972.) 

2. Dove and McKern, Failure Management of Multiple Gimbal Inertial 
Systems. AGARD Guidance and Control Panel 15th Symposium, Flor- 
ence, Italy, October, 1972. (Also published as CSDL K-726, August, 
1972.) 

3. Harrold Brown, David Dove and Richard McKern, Failure Detection and 
Isolation of Redundant Inertial Systems For Space Shuttle, Fifth IFAC 
Symposium on "Automatic Control in Space," Genoa, Italy, June, 1973, 

4. Richard McKern and Howard Musoff, Redundancy Management of Inertial 
Systems. AIAA 73-852, AIAA Guidance and Control Conference, Key 
Biscayne, August, 1973. 
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3 . 


HARDWARE DEVELOPMENT 


Design of this system was^ of course, an evolutionary process. A review of 
program milestones and major design decisions is presented here as an aid to 
understanding the design priciples behind the delivered system, 

3 . 1 Hardware Design Decisions 

A strawman system had been defined under Phase I of this contract (see CSDL 
R-733, this program’s interim report). Implementing this strawman in usable form 
made up the on-going design effort. 

Several major decisions were represented by the strawman itself. Early work 
in Phase I had considered four off-the-shelf aircraft IMUs for use in this system. 
Specification of the Kearfott IMU was made in August, 1971, At this time, decisions 
were also taken that the strawman would be designed using an IBM 4 tt-CP 2 computer 
and its ancillary equipment then available at NASA/MSFC. Three IMUs would be 
employed. Further, the system could make use of MSFC’s SSCMS for control and 
monitoring if desired. 

With the IMU and computer specified, their interface could be studied in detail. 
One early decision was that direct computer control of gyro pulse torquing was 
impractical in view of the large I/O requirements. Instead, the computer would 
issue only net torque commands in ternary form with dedicated logic at the IMU 
interface performing ternary-to-binary conversion and issuing each pulse command. 

Consideration of table slip rings (at the suggested test facility) showed them 
impractical for the total power requirements of three IMUs. In consequence, it 
was decided that the system's power and data bus lines should use "overhead" cables. 
The proposed test plans would be modified to take account of the table motion 
limitations imposed by such cabling. 

In February, 1972, attention was turned to external control and monitoring. 
Two options appeared to be the use of a Kearfott KT-70 test console, modified for 
redundant system use, or use of the SSCMS. It was decided that the SSCMS would 
be the better choice, in view of its built-in data processing, storage and display 
facilities. Further, the test table proposed for use by this system was mechanized 
for rate control by the SSCMS’s HP2116B computer. 
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The question of S/D converters was explored. Would each IMU interface require 
one per axis, or could a single convertor be multiplexed to serve all axes? The 
deciding factor was the complexity of interpolation logic required with a single 
convertor — without interpolation data staleness would be greater than acceptable 
limits for FDI. 

Preliminary designs for the data bus were also completed in February. The 
system would use a bus design approximating the McDonnell Douglas Corporation 
Phase B shuttle data bus design. The bus would employ biphase manchester coding 
at IMHz. No cross- strapping would be allowed at the peripheral device (that is. 
the IMU interface unit). All messages would be initiated by the computer, which 
implied that no hardware interrupts could be used. A maximum polling rate of 
50/ s was set. from which the computer minor cycle time of 20ms was determined. 

Sy June. 1972. the decision to use "overhead” cabling was firm, freeing table 
slip rings for parallel monitoring of the inertial system by the HP2116B computer. 
One factor in this decision was a contractual requirement that a parallel operation 
and monitoring capability exist. A proposal to use Kearfott GSE for this purpose 
(pluggable but not parallel) was turned down by MSFC. CSDL continued to examined 
this problem, and determined that it would be impossible for two source of command 
(i.e., two operating computers) to coexist. Therefore, a significant hardware impact 
would be required for command switchover, involving changing virtually all input 
lines by relays. Further, about 120 buffer amplifiers would be required. In August. 
1972, CSDL proposed dropping the parallel monitoring capability. The slip rings 
were reassigned to use for analog test points in the system. 

Preliminary design of the processor interface unit (PIU) was completed in 
June, 1972. The design involved making all data bus communications transparent 
to the 4TT-CP2. The digital link to the HP2116B, although a parallel rather than 
serial bus, was deemed an equivalent data bus address as far as the computer was 
concerned, saving building a direct computer-to-computer interface. The PIU was 
functionally a finite state machine, with hardware functions for parallel to serial 
and serial to parallel conversion, data routing and timing. 

As the design evolved, decisions were made to build the bus to the NASA/MSFC 
Type II Data Bus Terminal specification. Bus speed was increased to lOMHz. It 
also was decided tousereturn-to-zero alternate-mark-inversion coding compatable 
with this specification. 
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Expected useof the HP2116B and SSCMS in supporting testing of the redundant 
system was formalized in a meeting at NASA/MSFC* MSFC took responsibility for 
all HP2116B coding involving real time data monitoring and storage, data display 
and offline calculations. The HP2116B also was to exercise control over the test 
table, and to control SSCMS monitoring of system analog test points. 

Design of the IMU interface unit (lU) was progressing in parallel with other 
tasks. Although logical design was incomplete, specification of S/D convertors and 
wirewrap back planes were made, allowing mechanical design. Each lU was provided 
with 5 vdc and ±15 vdc power supplies, eliminating the need for the baselined table 
mounted interconnect box. Power, in other words, would be carried separately to 
each lU, with distribution accomplished in the GSE power panel. 

One major change was made to the existing PIU design-^ the three data buses 
were logically treated as being on one data bus transmitter rather than three separate 
transmitters. This change allowed a single command to be sent to all IMUs, and 
the requirement for a separate system sync line was dropped. 

A design review of the PIU and lU was held at NASA/MSFC in December, 

1972. Approval was granted and construction was begun. 

Final design of the power distribution panel (PDB) was completed in February, 

1973. Data bus transmitter and receiver designs were approved in March. 

System analog test point listings were firm in April and slip ring assignments 
were made in May. Hardware design of the system was considered complete in 
March, 1973. 

3.2 Hardware Construction History 


With design approval in December, 1972, purchase orders were issued for 
long lead time items: connectors, S/D convertors, back planes and the system 

master oscillator. 

Mechanical and electrical assembly of the PIU and one lU began the next month. 
PDB assembly started in February. Bus transmitters and receivers were assembled 
in March and April, 

Both the PIU and PDB were built and subjected to bench testing in April. lU 
was first tested in May. Assembly of lUs and 3 then followed. 
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string systGm int©gra,tion, using s GFE IMU 3 ind its Adaptor Pow©r 
Supply, was accomplished in July. System software testing followed with the IMU 
controlled by the 47r-CP2 in August. 


lUs #2 and 3 were cycled through the system in October and November with 
verification complete in December. 

A formal system selloff demonstration was held at CSDL in January, 1974 
and the redundant system was delivered to NASA/MSFC at the end of that month. 

3.3 Post Acceptance Modifications 

Two modifications have been made to the delivered hardware. 

As originally designed, power was applied to all IMUs by a single switch at 
the PDB. NASA/MSFC requested a modification permitting switching of power to 
individual strings. This change was made by adding switches in the excitation line 
to each string's power output relay in the PDB. 

A more important problem which appeared during system testing was a large 
apparent gyro bias instability, typically 0.1°/hr or twenty times the expected 
uncertainty. Analysis traced this uncertainty to use of a free-running multi-vibrator 
in the lU for the gyro pulse torquing (GYPTO) clock. Uncertainty was introduced 
through inability to set multi -vibrator frequency preciselyat 400 Hz. CSDL proposed 
and developed a solution in which a 400Hz clock line was added to the data bus. In 
effect, the sync line was reinstated in the system. This violated the original data 
bus specification, but yielded a system with tolerable gyro uncertainties, 

3.4 Hardware Overview 


A full description of the system is deferred to Volume II of this report. A 
summary of significant hardware features is appropriate here, however. 

This system is characterized by the control of three IMUs by a single computer. 
Operationally, this allows collaborative FDI and redundancy management not possible 
among multiple single string systems. 

This mechanization is achieved using a processor interface unit consisting of 
a sequential machine to carry out complex command and data retrieval tasks on a 
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single command from the computer* Control is exercised over a serial data bus 
similar in concept to the shuttle vehicle bus now specified. Bus transmitters and 
recievers were designed specifically toward this end* 

The overall system, then, consists of redundant off-the-shelf IMUs and an 
off-the-shelf computer. Interfaces have been designed to couple them into an 
integrated system capable of serving as a laboratory test facility for verification 
of shuttle hardware /software concepts. 
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4, SOFTWARE DEVELOPMENT 

Development and integration of software for the redundant IMU system was 
initially limited in scope by an intention to adapt existing coding to this usage. 
That is, ground alignment, gyrocompassing, navigation and calibration were to be 
based on single KT-70/4 tt-CP 2 coding performed for NASA/MSFC by Sperry Space 
Support Division, In fact, only the calibration program was used. 

Whether existing programs were employed or not, there was a need for a 
system executive, failure detection and isolation routines, redundancy management, 
and integration of the hardware and software through appropriate interfaces. These 
tasks, as anticipated, required the major part of time spent on software at CSDL, 
despite decisions not to use Sperry coding. 

The software task was extended beyond system verification and delivery by a 
contract modification calling for multiple navigator options. These options were 
incorporated in software Release 2, delivered in September 1974. 

4.1 Summary of Delivered Software 


Software was delivered in the form of two "tapes". Tape 1, FDINAV, contained 
all coding except the calibration program. Tape 2, IMUCAL, consisted of a multiple 
IMU calibration routine and the executive and I/O routines. Two tapes were required 
as program lengths exceeded space available in the computer. The 4tt-CP2 with 
its auxiliary memory has 32K 16 bit words of core. Tape 1 requires about 3 IK 
words, and Tape 2 22K. 

Tape 1 consists of support programs, application programs and schedulers. 
Support programs are the executive, typewriter operating system, IMU parameter 
compensation and downlink processor. Schedulers are written for initialization, 
alignment /gyro compassing and navigation /FDI modes. The application programs 
are ground alignment, gyrocompassing, navigation and the various FDI routines. 

Tape 2 comprises the calibration program and portions of the support 
programs. 

Detailed presentations of these programs appear in Volume III, Multiple IMU 
System Software Design and Coding, of this report. 
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4,2 Multiple System FDI Formulation 


The fundamental emphasis used in investigating the FDI problem was to 
introduce into simulations the best estimates of detection and identification thresholds 
connected with Shuttle flight phases. This permitted an evaluation which was 
addressed directly at the Shuttle problem and resulted in implementations which 
could be evaluated directly in terms of coverage and probability of success within 
performance requirements. Another aspect which was evaluated concerned the 
implementation of the complete redundancy management mechanization which inte- 
grated FDI with available BITE, and investigated the closed loop effects of multiple 
data selection filters and multiple navigators. This permitted evaluation of several 
crosstrapped system configurations. These simulations can be used to show how 
actual hardware characteristics influence the configuration signal -to -noise levels. 
They permit a more realistic look at specific configurations in terms of attainable 
coverage and missed and false alarm probabilities under various levels of IMU 
degradation, 

CSDL’s earliest work in FDI was concerned with the dodecahedron strapdown 
configuration (SIRU), begun in 1968, In this problem, the redundant gyroscope and 
accelerometer configurations can be completely divorced and separate formulations 
can be implemented using compensated instrument data in the body frame, A judgement 
about each instrument loop is made through a set of parity equations using individual 
data sources geometrically coordinatized to obtain common frame comparisons. 
The comparison basis could be the formulation of a simple averages, a least squares 
fit or a complete maximum likelihood estimator. In SIRU, the basis of error detection 
uses data transformations through fixed geometry for common frame solution of 
parity equations. The equivalent gimbal system parity equation development must 
recognize that no clean separation of instrument axis redundancy is possible. That 
is, redundant accelerometer outputs include not only accelerometer errors. Gyro 
error effects and stable member alignment geometry uncertainty infringe on the 
common frame voting process. Although various methods exist to untangle individual 
error sources the voting process is inherently more complex and ultimately capable 
of less resolution. 

As proposed early in 1971, the basic problems are to track the individual 
IMU stable member alignment with respect to all other IMUs, and to establish the 
validity of the IMU velocity outputs. The attitude screening step can be degraded 
but never bypassed completely. It could be limited, for example, to screening to 
the attitude delivery requirements of the flight control system. Fundamentally, it 
establishes each IMU*s stable member attitude with respect to another stable member 
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using an Euler angle sequence of gimbal angles. The accelerometer FDI is then a 
known geometry problem solved using parity equations. An alternative which was 
investigated establishes the relative stable member orientations by observing the 
accelerometers’ incremental velocity vectors. The incremental velocity vector 
magnitude differences, platform to platform, represent accelerometer error sources. 
The velocity vector cross-product yields relative attitude errors. The advantages 
of this method are that the gimbal chain Euler sequence with its associated 
uncertainties is by passed in producing the attitude divergence and that the accelerom- 
eter output data is finely quantized in existing off-the-shelf aircraft inertial hardware, 
A shortcoming of the approach is that the attitude error sensitivity is variable^ 
being maximum perpendicular to the vehicle input acceleration with no sensitivity 
to attitude errors about the input acceleration. The other fundamental problem in 
this approach appears at the two IMU level. Accelerometer scale factor and bias 
errors influence both incremental velocity vector magnitude and direction. Thus, 
it is difficult to discriminate between attitude and velocity error sources. This 
work has at various times been suggested to aid FDI initialization for azimuth 
alignment containment at launch, but has not been pursued further for Shuttle 
application, 

A closed loop implementation was also investigated which uses gimbal angle 
Euler sequences to establish each stable member relative to another. The average 
stable member position is then established and all individual stable members are 
torqued via a closed gyro loop to keep all IMUs actively coaligned. This results in 
a forced mechanical alignment of stable members to permit accelerometer voting 
directly in a mechanically established common reference frame. The system, then, 
is monitored for performance by tracking the gyro torquing required. This 
establishes the attitude divergence. This solution basically offers no better resolution 
then tracking the small angle errors in software, but it does simplify the software 
required for a velocity-based FDI as well as the requirements for generating 
incremental inertial velocity for navigation. This approach appears fruitful for 
use in a local level system. 

Separate algorithms have been selected and coded for this system based on 
attitude and velcotiy information at both the three colinear and two skewed IMU 
level. 


With colinear IMUs, an error vector is derived for each IMU (velocity or 
rotation vector). The sum of component magnitudes, axis by axis, is compared 
with a constant detection threshold. If that is exceeded, isolation is attempted by 
comparing individual components with a constant isolation threshold. 
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with skewed IMUs, an error vector is defined for each IMU. The velocity 
error vector is ^venbyan IMU *s measured AV minus the other IMU*s AV transformed 
into its own frame* The attitude error vector is derived from the stable member 
to stable member quaternion constructed from the gimbal angles. Detection is based 
upon comparison of the vector's magnitude with a constant threshold* Isolation is 
done by comparing the maximum component of the unit error vector with a second 
constant threshold. 

The delivered FDI and redundancy management software (documented in Volume 
III) includes most of the tracking test type FDI configuration now baselined for the 
Shuttle Approach and Landing Test (ALT) software* It could easily be modified to 
include the present FDI baseline using sequential probability ratio testing (SPRT) 
for Operational Flight Testing (OFT). 

4*3 Software Development Process 


As with the hardware, a baseline statement of system software requirements 
existed from phase I. The process of implementing the baseline is described below. 

4.3*1 Use of Existing Software 

Initial plans for this system's software were based on use of existing coding 
developed for NASA/ MSFC's single KT-70/47T-CP2 system* This software included 
a local level land navigator, ground alignment and gyrocompassing routines, and a 
calibration program. Only the calibration program was actually used in the redundant 
IMU system. 

Replacement of the local level navigator with an inertial navigator was an 
early step. This change was due to FDI requirements based upon gimbal angles; 
the torquing process required to maintain local level disallowed attitude FDI 
algorithms then under consideration* In consequence, a pure inertial land navigator 
was developed for this system* 

The gyrocompass delivered as GFE proved inadequate for an inertial system, 
although it was well suited for its intended use in a local level system. The routine 
leveled the platform but was not north seeking* Instead, azimuth offset was estimated 
and was compensated by the navigator* CSDL chose to derive and code alignment 
and north" seeking gyrocompass algorithms rather than modify this existing coding. 
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4.3.2 Design Timeline 

Requirements for system support software (exclusive of IMU compensation) 
were set by definition of the data bus interface. The preliminary definition was 
issued in June, 1972. 

System timing estimates were also made in June, based upon software developed 
for other systems. The executive overall design was completed in July, Detailed 
design (flowcharts) was prepared in August, The typewriter I/O program to support 
test activities could then be designed. That activity occupied September through 
November. In December, 1972, the system executive and typewriter I/O package 
were assembled using an MSFC- supplied 360 cross assembler. 

With the executive design firm, the HP2116B interface could be defined. CSDL 
met with NASA/MSFC personnel in October, 1972, to complete this definition. It 
was established that the 47T-CP2 would act as master in all computer /computer 
exchanges. Display and storage requirements were set. CSDL agreed to provide a 
50 pps sync signal to the HP2116B so that table angle readings could be synchronized 
with gimbal angles on the downlink. Scanning of the analog test points was also 
discussed and defined. 

System applications programming proceeded in a parallel effort. With use of 
existing coding eliminated, CSDL designed ground alignment, gyrocompass and 
inertial navigation routines. Based on analytical work and simulations performed 
over the previous year, four FDI algorithms were chosen. These provided for failure 
detection among three colinear IMUs (with separate algorithms based on velocity 
and attitude data) and between two skewed IMUs (again with separate algorithms 
using velocity and attitude information). Colinear IMU FDI algorithms were coded 
in December, 1972. Other application programs were coded and verified Over the 
next two months, except for skewed IMU FDI. That coding was completed in July, 
1973. 


The GFE multiple position calibration program was delivered to CSDL in April, 
1973. In June, additional positions were added to the sequence by MSFC to determine 
gyroscope g- sensitive drift terms, CSDL integrated its IMUCAL (Tape 2) in August. 

As hardware integration was accomplished, system software was excercised 
in increasing amounts. 4 tt-CP 2/PIU communication was demonstrated in September, 
1973. Communication with and control of the IMU was achieved in October. Debugging 
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of the application programs continued through system selloff and delivery (January, 
1974). 


Multiple string operation using Tape 1 occured in February, 1974, 

4«4 Post Delivery Modifications 

Four modifications have been made to Tape 1 since delivery. These corrected 
possible problem areas, incorrect navigation constants and incorrect levelling 
equations. Greater detail is given here than in the preceeding discussion because 
these modifications stand as corrections to the software described in Volume III of 
this report. 

One problem area involved an overflow condition. This condition would occur 
during ground alignment if gyro bias compensation terms exceeded 0.23^ /hr. 
Correction involved rescaling data items used in fixed point arithmetic. The other 
possible problem area involved false glmbal rate hard failure indications on startup. 
This problem was eliminated by defining a new initialization flag set only on the 
first pass following SYN, and RUN, commands. 

Changes to navigation constants involved interpretation of available NASA/ 
MSFC constants in terms of astronomic rather than geocentric latitude. 

The delivered version of Tape 1 contained incorrect equations for levelling 
the platform during slew (in the ground alignment sequence). Corrected equations 
were derived and incorporated, 

4.5 Software Developed Under the Follow-on Contract 


The follow-on contract encompassed additional software tasks. Navigation, 
which had been based on the average AV of the three IMUs, was expanded to include 
several options, A single navigator could be used, as in the initial release, with a 
choice among three pre- navigation selection filters. Alternatively, the user could 
command multiple string navigation (each IMU driving its own. navigator), with the 
three selection algorithms available for post-navigation use. The three filters were 
average AV, midvector AV and the Kaufman AV (least squares fit to forma resultant 
vector). 

Data down link lists were altered to accept this new information. (NASA/MSFC 
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updated display and storage formats to incorporate the additional data.) Requisite 
changes were made to the NAVFDI scheduler. No changes were required in the 
FDI algorithms. 

One other change involved altering the gyro compassing scheduler to terminate 
alignment on receipt of a discrete from a PIU switch, rather than according to a 
fixed preprogrammed time interval. This change permitted more detailed study of 
gyrocompass stability through varying settleout time allowances. 
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5. 


APPLICATION OF THIS SYSTEM AS A TEST TOOL 


CSDL has prepared a detailed system test plan (Volume IV of this report) 
designed to demonstrate capabilities of the delivered hardware. Emphasis is placed 
on FDI and redundancy management testing, the areas of new technology in the system 
software. Testing also involves evaluation of multiple IMU gyrocompassing, 
navigation and calibration. 

Beyond the contractual test plan, CSDL sees application of this system as a 
primary test tool for both the space shuttle vehicle and to formulate aircraft inertial 
system redundancy concepts. 

It has been said that the IMU, data bus and computer used in the laboratory 
system are similar to those specified for the shuttle. No multiple string system 
built to the shuttle hardware baseline will be ready before 1976, leaving this system 
as a principal test bed for shuttle FDI and redundancy management software 
development. 

This redundant system is also well suited for use in aircraft inertial system 
research and development. Most present inertial systems involve three independent 
strings, cross- strapped only manually by crew decisions. Clearly, the next step in 
aircraft system development will involve design of associative systems allowing 
autonomous fault detection and redundancy management both for navigation and for 
autopilot control. By virtue of the use of an off-the-shelf aircraft computer and 
IMUs, this system is similar to the evolving design, and can function as a primary 
test object, allowing great capability to formulate cross- strapping philosophies for 
flight and automatic landing research. 

Discussion of each of these application areas follows. Each section emphasizes 
both use of existing software and additional software which could be formulated. 

5.1 System as a Test Tool for Shuttle Concepts 

Although this system is similar to the shuttle inertial hardware, it is not 
identical. Coding developed for the shuttle cannot be used without rewriting it in 
4ir-CP2 assembly language. Yet this system can be used for experimentation with 
algorithms suggested for the shuttle. Suggestions are presented here for work with 
FDI and attitude determination. Examination of accelerometer bias attitude sensitivity 
is also explored. The system is generally applicable for engineering evaluation in 
FDI, calibration, initial alignment and navigation. 
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5.1.1 Failure Detection and Isolation 


The present FDI coding does not reflect all of the latest shuttle software 
requirements. Testing done with it is of value in establishing sensitivitieSj which 
can be used to give understanding to existing simulations. 

FDI which is now specified for the shuttle, however, appears to be fully 
compatible with this existing structure. Initial shuttle testing in ALT will employ 
IMU FDI limitedin scope, based primarily on the ’’tracking tests” which are presently 
implemented. 

For operational flight vehicles, statistical FDI (SPRT) developed at CSDL is 
specified. SPRT has been used successfully in redundant strapdown systems. For 
gimballed systems, however, work with it has been limited to simulations. Coding 
shuttle algorithms for test with the existing multiple IMU systems would provide a 
beneficial test tool well before operational shuttle coding is started, 

5.1.2 Attitude Determination 


The shuttle IMU will be used to determine vehicle attitude, as required for 
the digital autopilot. Several algorithms are under active consideration. 

While the attitude chain in the shuttle IMU differs significantly from the KT-70 
chain, these algorithms work only with the computed gimbal angle. Therefore, this 
system again can serve as a test bed for proposed shuttle software. 

5,1.3 Navigation 

Navigation is another area in which this system can be of use in the shuttle 
program. It is possible to design a navigator for this system which matches the 
shuttle software requirements. This coding would have the versatility required for 
navigator testing, and could with little effort be kept up to date with changing equation 
sets. 


In this area, empirical work could be done with various selection filter 
formulations, with recovery from failures, and with navigator sensitivity to redun- 
dancy management actions. 
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5,1.4 KT-7Q Accelerometer Bias Attitude Sensitivity 


Kearfott reports an accelerometer bias sensitivity to attitude in the shuttle 
IMU (a member of the KT-70 family). It is necessary to determine the magnitude 
of this problem, and whether it can be alleviated. If not, it will be necessary to 
devise techniques for calibrating and compensating for this effect. The present 
multiple IMU system could be used for this testing without having to change the 
calibration program significantly. Compensation routines would require only analysis 
and some recoding, 

5,1,5 Additional Software 

Other software which might be coded for this system includes calibration of 
misalignment and skewed IMU initial alignment. 

There is probably little value in extending the calibration program, as shuttle 
IMU calibration is well advanced. If this system is to be used outside the laboratory, 
however, intra-and inter^IMU misalignments would have to be calibrated and 
compensated. 

Extension of classical ground alignment and gyrocom pas sing to deal with 
skewed IMU s, as in the shuttle application, does not require new technology. However, 
no other facility for testing this coding presently exists, 

5,2 System as a Test Tool for Aircraft Concepts 

The laboratory demonstration system is well suited for aircraft applications 
work. With future requirements of aircraft Inertial hardware maturing rapidly, 
this configuration appears to be the next logical step in system design, Requirements 
which are forseen include fault tolerance, increasing dependence on inertial hardware 
by digital autopilots and fly-by-wire systems using significantly improved terminal 
area navigation aids for automatic guidance to the runway. 

The underlying assumption in each of these areas is that fault tolerance through 
autonomous fault detection and redundancy management can increase reliability to 
the point where automatic control is acceptable. This is a goal which must be met 
by similar systems in the shuttle. 
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Specific aircraft directed work which could be done with the existing system 
includes deriving and coding a local level navigator, developing an aided -inertial 
navigator, and designing an FDI formulation for use with local level systems. 

5.2.1 Local Level Navigator 

Presently, only a pure inertial navigator is coded for this system. Aircraft 
applications usually require a local level design. Suitable software compatible with 
this computer exists and has been tested to permit exploring aided navigation areas. 
It can be used to determine the additional level of fault identification attainable 
with skewed IMUs, as well as how to mechanize a system for this application. 

5.2.2 Aided-Inertial Navigator 

The laboratory system has no provision for navaid integration. Whether or 
not radio aids are added to the hardware, an aided-inertial navigator could be coded 
for testing. Dummy inputs would be used. Aircraft systems, in general, depend on 
radio aids for long term stability, and such systems are well understood. Of more 
interest at a developmental level are terminal area requirements with emphasis on 
short term preformance and screening capabilities. 

5.2.3 FDI for Local Level Systems 

FDI has been explored almost entirely in the context of pure inertial systems. 
There does not appear to beany theoretical prohibition of FDI in local level systems, 
but significant work remains to be done. CSDL has suggested that an active closed 
loop stable member coalignment torquing algorithm can be implemented in such a 
configuration, but has not carried the analysis into a simulation stage. If a local 
level navigator were implemented, this system would provide a test vehicle for 
aircraft directed FDI studies. 

5.3 Summary 

CSDL believes that the system described in this report can prove a useful 
test tool over the next few years. In two areas, shuttle and aircraft systems, it 
stands alone among existing hardware in approaching the design goals of a redundant 
system. For shuttle, therefore, it can be used for testing until other laboratory 
systems are on-line, and thus permit actual laboratory experience before final 
software flight requirements must be attained. 
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6 . 


SUMMARY OF PROGRAM ACCOMPLISHMENTS 


The redundant gimballed inertial system designed and delivered by CSDL 
required significant advances in inertial technology. Contributions to the art appear 
at all levels. 

The design philosophy in this program emphasizes redundant rather than simply 
multiple IMUs. That is, the system is designed to permit autonomous collaborative 
fault detection and identification, and fault correction through reconfiguration. This 
system is, in this light, the first practical redundant gimballed IMU system. It 
represents an extension of technology previously used only in redundant strapdown 
sensor systems. 

This program's effects are felt in two ways. First, this work has consistently 
paced and influenced the evolving space shuttle vehicle GN&C baseline design. Second, 
the hardware and software produced have pointed toward the next generation aircraft 
inertial navigation equipment. 

With respect to the shuttle baseline, this program has provided a continually 
maturing test bed in implementing the required capabilities in FDI and redundancy 
management. Algorithms have been considered and simulated primarily with a view 
of establishing applicability for the shuttle. Hardware development toward this system 
has also influenced the evolving baseline. 

Demonstration has been made of a practial redundant gimballed IMU system. 
Use of off-the-shelf aircraft IMUs controlled by a single flight computer using a 
simple data bus is shown to be an attainable step for aircraft inertial systems, 
increasing both their reliability and applicability for digital fly-by- wire aircraft 
control systems usage. 

In summary, the program reported here has played a germinal role in both 
the space shuttle program and in possible advanced avionics studies. 
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